Security and compliance
Your data
stays yours.
We build for Kenyan organisations handling sensitive records: payroll, student files, client details. Here is how we protect them, in plain terms, with no vague promises.
How we protect your records.
Encryption
Data is encrypted in transit over TLS/HTTPS, and encrypted at rest.
Access control
Role-based access limits who sees what. Admin accounts use multi-factor authentication.
Your data is yours
We don't sell or trade your data. You can export your records.
AI in our products
The assistant can only do what you can do.
Arche HR, Cogitus, Arbor, and Bohari IMS each include an assistant that works inside the product rather than a chat window bolted on the side. It runs with the same role-based permissions as the person signed in, so it can only see and change what that person already can, and in Bohari IMS every AI action is also written to its own AI audit log. Vuka OS ships with Fundi, an agent that drafts and proposes. Anything that spends money or messages fans waits for the artist's explicit approval, and unapproved proposals expire after 72 hours.
Every action it takes is logged against that account, the same as any other change made in the system. Lignea has no assistant.
See what each product doesBuilt around the DPA 2019
Registered, and accountable.
We follow Kenya's Data Protection Act, 2019. If a personal-data breach ever affects you, we will notify the Office of the Data Protection Commissioner within 72 hours, as the Act requires.
We are registered with the ODPC as a data processor, No. 659-2062-E512. Our full data-handling practices are written out in the Privacy Policy.